
Security News
/Company News
Securing the Financial Frontier: How Capital One Uses Socket for Open Source Security
Capital One is partnering with Socket to proactively secure its open source supply chain.
@kontor-mcp/core
Advanced tools
Kontor MCP — MCP-free core library: detect, parse, validate, generate, convert EN 16931 e-invoices (XRechnung, ZUGFeRD)
MCP-free TypeScript library behind Kontor MCP: detect, parse, validate (XSD + official EN 16931 / XRechnung Schematron via Saxon-JS, 89/89 parity with the KoSIT validator), audit with plausibility checks, convert UBL ⇄ CII, generate XRechnung 3.0 UBL and ZUGFeRD 2.3 PDF/A-3, and answer German e-invoicing obligations — all offline, no network, decimal-safe money math.
import { auditInvoice, generateInvoice, validateInvoice } from "@kontor-mcp/core";
const report = await auditInvoice(await fs.readFile("invoice.xml"));
console.log(report.recommendation, report.findings.map((f) => f.ruleId));
Main entry points: detectInvoice, parseInvoice, validateInvoice, auditInvoice / renderAuditText, generateInvoice (target: "zugferd-pdf"), convertInvoice, checkObligations, extractEmbeddedXml, renderHtmlPreview. Standards artefacts come from @kontor-mcp/rules. Docs, conformance evidence and the security posture: the repository README, docs/CONFORMANCE.md, SECURITY.md. Apache-2.0.
FAQs
Kontor MCP — MCP-free core library: detect, parse, validate, generate, convert EN 16931 e-invoices (XRechnung, ZUGFeRD)
The npm package @kontor-mcp/core receives a total of 311 weekly downloads. As such, @kontor-mcp/core popularity was classified as not popular.
We found that @kontor-mcp/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
/Company News
Capital One is partnering with Socket to proactively secure its open source supply chain.

Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.

Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.